It’s Getting Harder to Prove You Are Not A Robot

Over the years, Google’s ReCAPTCHA has evolved from the “I’m not a robot” button to more complicated and specific scenarios. It is the advanced version of the original CAPTCHA system that allows web hosts to distinguish human beings from machines. 

ReCAPTCHA is indubitably a useful asset for Google, as it competes with other internet giants to grow its datasets: The more data it analyses, the better results will be—providing its current and future products a competitive advantage. In simple terms, the way ML works is that you hand the machine a group of already sorted data—say, a bunch of images of dogs you have tagged. Then, the information is used to build a network that enables it to pick the dogs out of other images. So, the more pictures of dogs that you feed it, the more accurate the AI becomes at picking out dogs from other images.

Are you using Google? It’s the other way around 

In 2012, along with words, Google started including snippets of photos from ‘Google Street View’—making users transcribe door numbers, signs and other symbols. And in 2014, the scheme became focused on training AI. Essentially every user plays a minute role in piloting a driverless car somewhere, at some point in the future.

Google has several reasons to want to train AI to recognise objects in images:

• Better Google Image Search results
• More accurate Google Maps results
• Enabling users to search for specific objects or places in the Google Photos library

Since 2011, reCAPTCHA has digitised the entire Google Books archive and 13 million articles from the New York Times catalogue dating back to 1851.

Why are the questions getting trickier?

According to CAPTCHA: using hard AI problems for security by Ahn, Blum, and Langford, “any program that has high success over a captcha can be used to solve a hard, unsolved Artificial Intelligence (AI) problem. CAPTCHAs can be used in many places”.

Google replaced its CAPTCHA scheme with reCAPTCHA v1, which showed distorted text which had to be typed out to pass the test correctly. However, this version was defeated by Bursztein with 98% accuracy using an ML-based system to segment and recognise the text. As a result, image-based and audio-based reCAPTCHAs were introduced as a second version.

​​Previous work showed that the image challenges of reCAPTCHA v2 could be solved by automated programmes armed with Deep Neural Network (DNN) image classifiers and vision APIs provided by off-the-shelf image recognition services. However, in response to emerging threats, Google has made significant updates to its image reCAPTCHA v2 challenges that can render the prior approaches ineffective to a great extent.

In 2018, Google launched reCAPTCHA v3, which works by returning a score for each request without user friction. In case a user fails reCAPTCHA v3, they can be prompted with an additional challenge to prove. This was a leap forward from the past versions where reCAPTCHA tests would create significant problems with user flow.

When a user enters the website, a score ranging from 0 (most likely bot) to 1 (most likely human) is generated. With time, reCAPTCHA learns how users on the website typically act—helping the underlying machine learning algorithm generate more accurate risk scores.

The latest version is reCAPTCHA Enterprise that offers unique capabilities built specifically for the enterprise and provides enhanced detection measures, such as extra-granular scores, reason codes for high-risk scores, and the ability to tune the risk analysis engine to the site’s specific needs.